feat: plan 16-01

AINative_OKR_CASAN5/.specify/scripts/bash/model-router.sh

@@ -12,8 +12,9 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # Opt-in governance preflight (default off ⇒ no change to existing flows).
 # When enabled, enforces RAI data governance (e.g. PII must not reach a cloud
-# model without approval) BEFORE the model call.
-if [[ "${CASAN_PREFLIGHT:-0}" == "1" ]]; then
+# model without approval) BEFORE the model call. SEC-17 (ARCH-03): default ON under
+# CASAN_PROFILE=prod (secure-by-default); an explicit CASAN_PREFLIGHT=0 still wins.
+if [[ "${CASAN_PREFLIGHT:-0}" == "1" || ( -z "${CASAN_PREFLIGHT+x}" && "${CASAN_PROFILE:-}" == "prod" ) ]]; then
   bash "$SCRIPT_DIR/harness-preflight.sh" "$@" >/dev/null || exit $?
 fi